Which Bridge Has Never Been Hacked? Track Records Compared
Quick answer. No bridge can prove it was never hacked. Through November 14, 2026, we found no protocol-level exploit for Chainlink CCIP, Across, deBridge or Circle's CCTP contracts. Wormhole, Ronin and Nomad were exploited, as were integrations on LayerZero, Axelar and CCTP.
Video transcript
No bridge can prove it was never hacked. A clean record is often a treasury's first question, and the easiest claim to misread.
Through November 14, 2026, we found no protocol-level exploit for CCIP, Across, deBridge, Stargate or Circle's CCTP contracts. Each record rests partly on the provider's own claims.
CCIP's current design, CCIP 2.0, went live on September 28, 2026, so its record under that design is short.
Integrations fail too. On August 19, 2026, Allbridge's CCTP router lost about 190 thousand dollars by crediting an attested message that never burned USDC.
Wormhole, Ronin and Nomad were exploited in 2022. In 2026, a Kelp DAO route on LayerZero lost about 292 million dollars.
Detection matters. Ronin's theft was found six days later; Secret says Axelar told it seven days after. Wormhole paid a 10 million dollar bounty for a near miss.
In Guardian's Olympus LayerZero report, a bridge meant to pin two DVNs encoded optional DVNs as zero, meaning use the default. A later default change could raise fees or block delivery.
Before bridging, read the live verifier set onchain. Ask about independent RPC sources, source authentication, rate limits, upgrade timelocks and monitoring.
Read the full article for both tables. Shipping a bridge or bridged token? Guardian's smart contract audit puts two independent teams on one scope.
Why This Question Matters
A clean record is often the first thing a treasury asks for. It is also the easiest claim to misread.
2026 sharpened the question. Kelp DAO's rsETH route on LayerZero lost 116,500 rsETH, about $292M, on April 18. An Axelar integration with Secret Network lost about $4.67M on June 10. LayerZero, Secret Network
This page asks what a clean record proves. Our ranking of the biggest bridge hacks covers the losses.
How We Built the Table
Never hacked here means no publicly documented protocol-level exploit in the sources we reviewed, up to the date this page was updated. No source can prove a negative.
The label does not cover front ends, staff, relayers, integrations, token contracts or connected chains. Any of those can fail while the core protocol holds, and several cases below did.
The tables cover bridges secured by their own verifiers, signers or relayers.
Canonical rollup bridges, such as Arbitrum's, OP Stack's and Base's, rest on rollup proofs and upgrade keys, so they are out of scope.
Out of scope is not clean: in September 2022, Offchain Labs paid 400 ETH for an unexploited Arbitrum bridge bug. Decrypt
Hop, Synapse, Celer cBridge, Hyperlane and Polygon PoS are not covered here.
We list pauses and near misses next to exploits. A route that halts for days can still strand treasury funds.
Volumes are each provider's own figures, and they measure different things: transfer volume, transferred value or settled volume. Use them for scale, not for ranking. Chainlink Foundation, LayerZero, deBridge
Bridges With No Exploit on Record
These systems had no protocol-level exploit in the sources we reviewed, though an integration built on CCTP was exploited. Each record rests partly on the provider's own claims.
CCIP's docs describe a 16-operator committee that needs 9 attestations, source-chain finality, issuer-set rate limits and timelocked security-critical upgrades. Our LayerZero vs Chainlink CCIP comparison sets that committee against app-chosen verifiers. Chainlink Documentation, Chainlink
Its mainnet record starts July 17, 2023, the shortest of the five. Its current design, CCIP 2.0 with optional Cross-Chain Verifiers, went live on September 28, 2026, so its record under that design is short.
Across says it has never lost user funds to a protocol-level failure across $35B+ in volume. Across
In 2025, a compiler mismatch in a Lens upgrade paused Lens bridging for three to four days. Across called it an operational mistake, with no user funds at risk.
On November 10, 2026, an attacker took across.to through social engineering at its registrar, Namecheap. Across recovered it and promised to make users whole; see our Across domain hijack report. Across Protocol
Circle launched CCTP on Ethereum and Avalanche on April 26, 2023. It moves native USDC by Circle-attested burn and mint. Circle
We found no exploit of Circle's CCTP contracts. But Allbridge's CCTP router on Base lost about $190K on August 19, 2026, because it credited an attested message that never burned USDC. SlowMist, Odaily
In August 2024, Asymmetric Research disclosed a bug in Circle's noble-cctp that skipped the TokenMessenger sender check. It was fixed with no funds lost. Asymmetric Research
| Protocol | Verification model | Live since | Value moved (own figure) | Pauses and near misses |
|---|---|---|---|---|
| Chainlink CCIP | 16-operator committee; 9 must attest | July 17, 2023; CCIP 2.0 since Sept 28, 2026 | $26.34B cumulative, October 2026 | None found in reviewed sources |
| Across | Relayers front funds; UMA optimistic settlement | November 8, 2021 | $35B+, May 2026 | Lens upgrade pause, 2025; domain hijack, November 2026 |
| deBridge | Elected validators; 8 signatures, two-thirds of the set | February 17, 2022 | $23B+ settled | Staff phishing attempt, August 2022 |
| Circle CCTP | Circle attestation; native USDC burn and mint | April 26, 2023 | No primary figure found | Allbridge integration exploit, Aug 2026; Noble sender-check bug, fixed 2024 |
| Stargate | LayerZero messaging | March 17, 2022 | No primary figure found | Governance phishing post, Dec 2023, about $43K from users |
Bridges That Were Hacked
Five well-known systems have a documented exploit. Three failed in the protocol's own code or keys; two failed on a route or integration.
Scale did not prevent loss, as the volume column shows.
Two cases sit at the protocol's edge. LayerZero says route security is the application's to configure, and Secret says Axelar's core protocol was not affected. Our Kelp DAO breakdown sets out LayerZero's and Kelp's accounts. LayerZero, Secret Network
So a protocol's record and a route's record can differ. Ask which one any clean-record claim describes.
Ronin shows why detection belongs in the comparison. Our Ronin bridge hack breakdown covers how the keys were taken.
Axelar shows it too. Secret Network says Axelar notified it on June 17, seven days after the June 10 exploit, and still says not to bridge via Axelar.
Wormhole also had a near miss: on February 24, 2022, a whitehat reported an uninitialized proxy bug in its Ethereum core bridge. Wormhole paid a $10M bounty, and no funds were lost. Immunefi
| System | Verification model | Live since, volume | Incident | Afterward |
|---|---|---|---|---|
| Wormhole | Messages need 13 of 19 Guardian signatures (VAAs) | Early 2021; $40B+ by Sept 2024 | Feb 2, 2022: 120,000 wETH, about $320M to $326M; Solana signature check bypassed | Service halted; 1:1 backing restored |
| LayerZero (Kelp DAO route) | App-chosen DVNs per route | Beta by March 2022; $270B+ by June 2026 | Apr 18, 2026: 116,500 rsETH, about $292M; sole DVN fed compromised RPC data | LayerZero Labs refuses sole-DVN channels |
| Axelar (Secret integration) | Validator network; 75 active validators in 2025 | Jan 13, 2022; $10B+ by June 2025 | Jun 10, 2026: about $4.67M unbacked tokens; counterfeit-chain deposit bypassed source checks | Secret told June 17; Axelar bridging still disabled |
| Ronin bridge | Five of nine validator signatures (2022 design) | Ronin mainnet, February 2021 | Mar 23, 2022: about $624M (DefiLlama); five validator keys compromised | Found six days later; legacy bridge moved to CCIP, 2025 |
| Nomad | Messages checked against a trusted root | No launch date verified | Aug 1, 2022: about $190M; upgrade made messages valid by default | Figure is gross, before any recovery |
Why Track Record Is Not Enough
A clean record shows that no attack has succeeded so far. It does not show which attacks a design would survive.
The failures above fall into four classes: compromised keys, flawed message checks, unsafe configuration, and upgrade or infrastructure mistakes. Guardian Resource Hub
Upgrades reset part of any record. Nomad's loss followed one, and so did Across's 2025 Lens pause. Across
Headline verifier counts can mislead too. A route's resolved settings can look right today while its raw configuration still inherits defaults that can change. Guardian
Guardian found this in Olympus's LayerZero integration. The bridge meant to pin exactly two required DVNs, but encoded optional DVNs as 0, which means use the default (M-01, Medium, resolved).
A later LayerZero default change could then add a DVN requirement without governance action, raising fees or blocking delivery.
The fix used LayerZero's NIL sentinel, type(uint8).max, for no optional DVNs. Reading raw app config, not only resolved config, is what shows it.
For the mechanics behind each failure class, see our guide to cross-chain bridge security.
What to Check Before Bridging
Ask for evidence on the exact route and chain pair you will use. Then confirm it onchain, yourself or through a reviewer.
For LayerZero routes, our LayerZero DVN configuration guide lists the onchain calls that show live settings.
Teams shipping a bridge or bridged token can scope the review with our cross-chain bridge audit guide.
| Check | Evidence to ask for | Red flag |
|---|---|---|
| Verifier set and threshold | Live verifier list and threshold for your route, read onchain | One verifier, or settings left on defaults |
| Operator independence | Who runs each verifier, signer and node | Several keys or verifiers under one company |
| RPC diversity | Independent data sources per verifier, and quorum rules | One provider, or no rule when sources disagree |
| Source authentication | How the destination checks source chain and sender | Deposits accepted from unverified chains or senders |
| Rate limits | Inbound and outbound caps per route and time window | No caps, or caps sized to total supply |
| Pause controls | Who can pause a route, and how fast | One key both pauses and unpauses |
| Supply reconciliation | Backing against minted supply on every chain | No public reconciliation or gap alerts |
| Upgrade controls | Timelock length and who can bypass it | Instant upgrades from a single key |
| Incident disclosure | Written reports for every pause and incident | Clean-record claims with no incident log |
| Monitoring | Block-by-block alerts on outflows and configuration changes | Users report problems before the team does |
Frequently Asked Questions
Can a bridge that was hacked be a better choice than one that was not?
It can. A record does not show controls added since. After the Kelp exploit, LayerZero Labs began requiring a quorum of independent RPC sources for its DVN. Compare the current controls on your route, not past headlines. LayerZero
Was 2026 a quiet year for bridge hacks?
No. Guardian's DefiLlama-based ranking counts 51 flagged bridge hacks worth $753.5M in 2026 through November 5, against $38.3M in all of 2025. Both are gross figures, before recoveries. Guardian Resource Hub
How often should a treasury recheck a bridge route?
Before each large transfer, and after any upgrade, verifier change, pause or incident on that route. Verifier sets, contract versions and volumes all change, so last quarter's review may describe a different route.
Related reading
- biggest bridge hacks
- cross chain bridge security
- layerzero vs wormhole
- layerzero vs chainlink ccip
- cross chain bridge audit
Sources
- Chainlink Documentation: What is Chainlink CCIP?
- Chainlink: CCIP Officially Launches on Mainnet
- Chainlink Foundation: Chainlink Metrics
- Across: Why Security and Decentralization Matter Now More Than Ever
- Across: Across Incident Report: Lens Upgrade and Resolution
- deBridge: deBridge Security
- deBridge: deBridge Mainnet is here
- BleepingComputer: deBridge Finance crypto platform targeted by Lazarus hackers
- Wormhole: Messaging
- Wormhole: Wormhole launches Era3
- CBS News: Cryptocurrency platform Wormhole restores funds after suffering $320 million hack
- LayerZero: Cross-Chain Messaging
- LayerZero: LayerZero External Incident Report [FINAL]
- U.S. Securities and Exchange Commission: Meeting with Representatives of Interop Labs Inc.
- Secret Network: Security Incident: Axelar<>Secret IBC Bridge Exploit
- Japan Financial Services Agency research project (QUNIE): Research Report of JFSA Multilateral Joint Research on the Chains of Trust of Decentralized Finance (Summary)
- Guardian Resource Hub: Cross-Chain Bridge Security: How Bridges Get Hacked
- Guardian Resource Hub: Biggest Bridge Hacks Ranked, With Root Causes
- Guardian: Olympus LayerZero Integration Audit Report
- Across Protocol: Across Protocol warning about across.to domain incident
- Across Protocol: Across Protocol domain recovery and incident disclosure
- Across: Across Protocol is live and you can be a Co-Founder
- Chainlink Documentation: CCIP Architecture Overview
- Circle: Circle Delivers USDC Interoperability Across Ecosystems with Mainnet Launch of CCTP
- Stargate Foundation: Stargate Protocol Launch Details
- LayerZero co-founder Bryan Pellegrino: Stargate governance phishing warning
- crypto.news: Stargate used voting for a $43k phishing attack
- Chainlink: Introducing CCIP 2.0: The Interoperability Standard for Institutions
- SlowMist: SlowMist Hacked: bridge incidents, Allbridge entry of 2026-08-19
- Odaily: SlowMist Unveils Details of Allbridge Bridge Attack: Forged CCTP Messages + Flash Loans, Insufficient Mint Verification
- Asymmetric Research: Circle's CCTP Noble Mint Bug
- Ronin: The Ronin Bridge <> Chainlink CCIP migration is complete!
- Ronin: Introduction | Ronin Docs
- deBridge: Cross-Chain Call Lifecycle
- Wormhole: Guardians | Wormhole Docs
- Immunefi: Wormhole Uninitialized Proxy Bugfix Review (May 20, 2022)
- Decrypt: Hacker Saves Arbitrum From Ethereum-Draining Bug in Nitro Upgrade
- a16z: Investing in LayerZero
- deBridge: Protocol Overview
Check the route before value moves through it
Shipping a bridge or bridged token? Guardian's smart contract audit puts two independent teams on one scope, covering OFTs, DVNs, peers, shared decimals, replay and compose flows.